The Experts below are selected from a list of 9111 Experts worldwide ranked by ideXlab platform
Rossow Christian - One of the best experts on this subject based on the ideXlab platform.
-
ret2spec: Speculative Execution Using Return Stack Buffers
'Association for Computing Machinery (ACM)', 2018Co-Authors: Maisuradze Giorgi, Rossow ChristianAbstract:Speculative Execution is an optimization technique that has been part of CPUs for over a decade. It predicts the outcome and target of branch instructions to avoid stalling the Execution Pipeline. However, until recently, the security implications of speculative code Execution have not been studied. In this paper, we investigate a special type of branch predictor that is responsible for predicting return addresses. To the best of our knowledge, we are the first to study return address predictors and their consequences for the security of modern software. In our work, we show how return stack buffers (RSBs), the core unit of return address predictors, can be used to trigger misspeculations. Based on this knowledge, we propose two new attack variants using RSBs that give attackers similar capabilities as the documented Spectre attacks. We show how local attackers can gain arbitrary speculative code Execution across processes, e.g., to leak passwords another user enters on a shared system. Our evaluation showed that the recent Spectre countermeasures deployed in operating systems can also cover such RSB-based cross-process attacks. Yet we then demonstrate that attackers can trigger misspeculation in JIT environments in order to leak arbitrary memory content of browser processes. Reading outside the sandboxed memory region with JIT-compiled code is still possible with 80\% accuracy on average.Comment: Updating to the cam-ready version and adding reference to the original pape
-
Ret2Spec: Speculative Execution Using Return Stack Buffers
'Association for Computing Machinery (ACM)', 2018Co-Authors: Maisuradze Giorgi, Rossow ChristianAbstract:Speculative Execution is an optimization technique that has been part of CPUs for over a decade. It predicts the outcome and target of branch instructions to avoid stalling the Execution Pipeline. However, until recently, the security implications of speculative code Execution have not been studied. In this paper, we investigate a special type of branch predictor that is responsible for predicting return addresses. To the best of our knowledge, we are the first to study return address predictors and their consequences for the security of modern software. In our work, we show how return stack buffers (RSBs), the core unit of return address predictors, can be used to trigger misspeculations. Based on this knowledge, we propose two new attack variants using RSBs that give attackers similar capabilities as the documented Spectre attacks. We show how local attackers can gain arbitrary speculative code Execution across processes, e.g., to leak passwords another user enters on a shared system. Our evaluation showed that the recent Spectre countermeasures deployed in operating systems can also cover such RSB-based cross-process attacks. Yet we then demonstrate that attackers can trigger misspeculation in JIT environments in order to leak arbitrary memory content of browser processes. Reading outside the sandboxed memory region with JIT-compiled code is still possible with 80% accuracy on average
Maisuradze Giorgi - One of the best experts on this subject based on the ideXlab platform.
-
ret2spec: Speculative Execution Using Return Stack Buffers
'Association for Computing Machinery (ACM)', 2018Co-Authors: Maisuradze Giorgi, Rossow ChristianAbstract:Speculative Execution is an optimization technique that has been part of CPUs for over a decade. It predicts the outcome and target of branch instructions to avoid stalling the Execution Pipeline. However, until recently, the security implications of speculative code Execution have not been studied. In this paper, we investigate a special type of branch predictor that is responsible for predicting return addresses. To the best of our knowledge, we are the first to study return address predictors and their consequences for the security of modern software. In our work, we show how return stack buffers (RSBs), the core unit of return address predictors, can be used to trigger misspeculations. Based on this knowledge, we propose two new attack variants using RSBs that give attackers similar capabilities as the documented Spectre attacks. We show how local attackers can gain arbitrary speculative code Execution across processes, e.g., to leak passwords another user enters on a shared system. Our evaluation showed that the recent Spectre countermeasures deployed in operating systems can also cover such RSB-based cross-process attacks. Yet we then demonstrate that attackers can trigger misspeculation in JIT environments in order to leak arbitrary memory content of browser processes. Reading outside the sandboxed memory region with JIT-compiled code is still possible with 80\% accuracy on average.Comment: Updating to the cam-ready version and adding reference to the original pape
-
Ret2Spec: Speculative Execution Using Return Stack Buffers
'Association for Computing Machinery (ACM)', 2018Co-Authors: Maisuradze Giorgi, Rossow ChristianAbstract:Speculative Execution is an optimization technique that has been part of CPUs for over a decade. It predicts the outcome and target of branch instructions to avoid stalling the Execution Pipeline. However, until recently, the security implications of speculative code Execution have not been studied. In this paper, we investigate a special type of branch predictor that is responsible for predicting return addresses. To the best of our knowledge, we are the first to study return address predictors and their consequences for the security of modern software. In our work, we show how return stack buffers (RSBs), the core unit of return address predictors, can be used to trigger misspeculations. Based on this knowledge, we propose two new attack variants using RSBs that give attackers similar capabilities as the documented Spectre attacks. We show how local attackers can gain arbitrary speculative code Execution across processes, e.g., to leak passwords another user enters on a shared system. Our evaluation showed that the recent Spectre countermeasures deployed in operating systems can also cover such RSB-based cross-process attacks. Yet we then demonstrate that attackers can trigger misspeculation in JIT environments in order to leak arbitrary memory content of browser processes. Reading outside the sandboxed memory region with JIT-compiled code is still possible with 80% accuracy on average
Et Al. ,hans Vandierendonck - One of the best experts on this subject based on the ideXlab platform.
-
By-Passing the Out-of-Order Execution Pipeline to Increase Energy-Efficiency
2007Co-Authors: Et Al. ,hans VandierendonckAbstract:Out-of-order Execution significantly increases the performance of superscalar processors. The out-of-order Execution mechanism is, however, energy-inefficient, which inhibits scaling superscalar processors to high issue widths and large instruction windows. In this paper, we build on the observation that between 19% and 36 % of the instructions are immediately ready for Execution, even before entering the issue queue. Yet, these instructions proceed to the energy-consuming steps of instruction wake-up and select and they needlessly occupy space in the issue queue. To save energy, we propose for these instructions to by-pass the out-of-order Execution core. Instead, we execute them on an energy-efficient single-issue in-order by-pass Pipeline. The by-pass Pipeline executes a significant fraction of all instructions, allowing performance-energy trade-offs with respect to the issue width of the out-of-order Pipeline and to the issue queue size. By making these trade-offs, we show energy reductions of 53 % for the issue queue, 33 % for the register file and 31 % in the write-back and wake-up logic. Performance remains almost unaffected
Alex Orailoglu - One of the best experts on this subject based on the ideXlab platform.
-
Mobile Ecosystem Driven Dynamic Pipeline Adaptation for Low Power
2020Co-Authors: Garo Bournoutian, Alex OrailogluAbstract:Abstract. State-of-the-art mobile smartphone and tablet processors are beginning to employ fully speculative, out-of-order architectures with deep instruction Pipelines. These processors often have Pipeline lengths of 24 or more stages. Furthermore, to improve high-performance ILP, these processors provide multiple parallel Pipeline paths for various instruction types. These architectures provide multiple Execution clusters defined by instruction type, each with its own issue queue. Instructions are dispatched to one of the appropriate issue queues, and all issue queues are then scanned in parallel to identify instructions ready for Execution. The goal of such a resource-intensive architectural design is to sustain peak processor performance. Unfortunately, applications oftentimes only leverage a small subset of these robust computation resources, and the excess hardware resources still consume power while idle. This paper proposes a novel methodology that leverages the unique characteristics of the mobile ecosystem to drive hardware adaptation for a powerefficient Execution Pipeline microarchitecture. The proposed architecture will monitor the run-time Execution behavior in order to enable only those Pipeline resources that are currently needed, allowing the system to rapidly respond to changing resource demands to ensure performance is maintained while reducing power consumption. The simulation results show that processor performance is maintained while achieving a significant reduction in Execution Pipeline power consumption
Battle, Steven James - One of the best experts on this subject based on the ideXlab platform.
-
Efficient Scaling of Out-of-Order Processor Resources
Drexel University, 2015Co-Authors: Battle, Steven JamesAbstract:Rather than improving single-threaded performance, with the dawn of the multi-core era, processor microarchitects have exploited Moore's law transistor scaling by increasing core density on a chip and increasing the number of thread contexts within a core. However, single-thread performance and efficiency is still very relevant in the power-constrained multi-core era, as increasing core counts do not yield corresponding performance improvements under real thermal and thread-level constraints. This dissertation provides a detailed study of register reference count structures and its application to both conventional and non-conventional, latency tolerant, out-of-order processors. Prior work has incorporated reference counting, but without a detailed implementation or energy model. This dissertation presents a working implementation of reference count structures and shows the overheads are low and can be recouped by the techniques enabled in high-performance out-of-order processors. A study of register allocation algorithms exploits register file occupancy to reduce power consumption by dynamically resizing the register file, which is especially important in the face of wider multi-threaded processors who require larger register files. Latency tolerance has been introduced as a technique to improve single threaded performance by removing cache-miss dependent instructions from the Execution Pipeline until the miss returns. This dissertation introduces a microarchitecture with a predictive approach to identify long-latency loads, and reduce the energy cost and overhead of scaling the instruction window inherent in latency tolerant microarchitectures. The key features include a front-end predictive slice-out mechanism and in-order queue structure along with mechanisms to reduce the energy cost and register-file usage of executing instructions. Cycle-level simulation shows improved performance and reduced energy delay for memory-bound workloads. Both techniques scale processor resources, addressing register file inefficiency and the allocation of processor resources to instructions during low ILP regions.Ph.D., Computer Engineering -- Drexel University, 201